@tangle-network/starter-foundry 0.7.3 → 0.13.2

package/registry/layers/agent-channels/gmail/manifest.json

@@ -0,0 +1,95 @@
+{
+  "id": "gmail",
+  "slot": "agent-channels",
+  "description": "Gmail channel adapter \u2014 OAuth 2.0 (installed-app flow) + Gmail REST API. Default path is pull-based: poll users.messages.list?q=is:unread, fetch each via users.messages.get, mark read after dispatch. send() encodes RFC 5322 and POSTs to users.messages.send. Push-based (Pub/Sub watch) is documented but not wired in MVP \u2014 see channels/gmail.env.example.",
+  "appliesTo": [
+    "agent-runtime-account-executive-ts",
+    "agent-runtime-architect-ts",
+    "agent-runtime-auditor-ts",
+    "agent-runtime-biology-research-ts",
+    "agent-runtime-business-partner-ts",
+    "agent-runtime-career-coach-ts",
+    "agent-runtime-chef-ts",
+    "agent-runtime-chemistry-research-ts",
+    "agent-runtime-cmo-advisor-ts",
+    "agent-runtime-college-counselor-ts",
+    "agent-runtime-cs-research-ts",
+    "agent-runtime-cs-tutor-ts",
+    "agent-runtime-customer-success-ts",
+    "agent-runtime-data-analyst-ts",
+    "agent-runtime-designer-ts",
+    "agent-runtime-devops-ts",
+    "agent-runtime-doctor-ts",
+    "agent-runtime-engineering-manager-ts",
+    "agent-runtime-essay-coach-ts",
+    "agent-runtime-financial-analyst-ts",
+    "agent-runtime-fitness-coach-ts",
+    "agent-runtime-friend-ts",
+    "agent-runtime-game-designer-ts",
+    "agent-runtime-grant-writer-ts",
+    "agent-runtime-history-tutor-ts",
+    "agent-runtime-illustrator-ts",
+    "agent-runtime-language-tutor-ts",
+    "agent-runtime-legal-counsel-ts",
+    "agent-runtime-math-research-ts",
+    "agent-runtime-math-tutor-ts",
+    "agent-runtime-mediator-ts",
+    "agent-runtime-meditation-coach-ts",
+    "agent-runtime-ml-research-ts",
+    "agent-runtime-music-producer-ts",
+    "agent-runtime-novelist-coach-ts",
+    "agent-runtime-nutritionist-ts",
+    "agent-runtime-pentester-ts",
+    "agent-runtime-pharmacist-ts",
+    "agent-runtime-photographer-ts",
+    "agent-runtime-physics-research-ts",
+    "agent-runtime-product-manager-ts",
+    "agent-runtime-real-estate-ts",
+    "agent-runtime-recruiter-ts",
+    "agent-runtime-relationship-coach-ts",
+    "agent-runtime-research",
+    "agent-runtime-sales-engineer-ts",
+    "agent-runtime-screenwriter-ts",
+    "agent-runtime-security-engineer-ts",
+    "agent-runtime-tax-ts",
+    "agent-runtime-therapist-ts",
+    "agent-runtime-travel-planner-ts",
+    "agent-runtime-veterinarian-ts",
+    "agent-runtime-wealth-manager-ts",
+    "multi-agent-creative-studio-ts",
+    "multi-agent-legal-ops-ts",
+    "multi-agent-product-ops-ts",
+    "multi-agent-research-lab-ts",
+    "multi-agent-startup-team-ts"
+  ],
+  "provides": [
+    "channel:gmail"
+  ],
+  "requires": [
+    "secure:secrets"
+  ],
+  "defaults": {
+    "channelGmailAvailable": true
+  },
+  "files": [
+    {
+      "source": "files/channels/gmail.ts",
+      "target": "channels/gmail.ts"
+    },
+    {
+      "source": "files/channels/gmail.env.example",
+      "target": "channels/gmail.env.example"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "channels/gmail.ts"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "channels/gmail.ts"
+    ]
+  }
+}

package/registry/layers/agent-channels/imessage/files/channels/imessage.env.example

@@ -0,0 +1,31 @@
+# iMessage via BlueBubbles HTTP relay.
+#
+# IMPORTANT: There is no pure-cloud iMessage API. Apple does not expose one.
+# BlueBubbles is the standard community workaround — it runs on a macOS host
+# that is signed into iMessage and exposes the local message database + send
+# queue as an HTTP API.
+#
+# Install BlueBubbles Server: https://bluebubbles.app
+# Docs:                       https://docs.bluebubbles.app
+# API reference:              https://documenter.getpostman.com/view/765844/UV5RnfwM
+#
+# Step-by-step:
+#  1. Install BlueBubbles Server on a Mac that's signed into iMessage.
+#  2. Set a Server Password in the BlueBubbles UI (Settings → Server).
+#  3. Expose the server: either tunnel via ngrok / Cloudflare Tunnel, run on
+#     a machine reachable from the agent's host, or keep both on the same
+#     private network.
+#  4. (Recommended) In the BlueBubbles UI → Settings → Webhooks, add a webhook
+#     pointing at <your-server>/webhooks/imessage subscribed to `new-message`.
+#     Without webhooks, you must poll /api/v1/message — webhooks are strongly
+#     preferred.
+
+# Base URL of the BlueBubbles Server (no trailing path), e.g.
+#   http://192.168.1.42:1234
+#   https://bluebubbles.example.com
+BLUEBUBBLES_SERVER_URL=
+
+# Server password set in the BlueBubbles UI. Used both as the auth query-param
+# on outbound calls and as the HMAC key for verifying inbound webhook
+# signatures (when webhook signing is enabled in BlueBubbles).
+BLUEBUBBLES_PASSWORD=

package/registry/layers/agent-channels/imessage/files/channels/imessage.ts

@@ -0,0 +1,123 @@
+// MIT — adapted from nanoclaw (https://github.com/qwibitai/nanoclaw)
+//
+// iMessage channel adapter via the BlueBubbles HTTP relay.
+//
+// HONEST GAP: Apple does not expose a server-side iMessage API. There is no
+// pure-cloud path. BlueBubbles (https://bluebubbles.app) is the standard
+// community workaround: it runs as a process on a Mac you control and exposes
+// the local iMessage database + send queue as an HTTP API.
+//
+// Set up:
+//   1. Install + run BlueBubbles Server on a Mac that's signed into iMessage.
+//   2. Open a port (or use ngrok / a tunnel) so this process can reach it.
+//   3. Configure a Server Password in the BlueBubbles UI.
+//   4. (Optional) Enable webhooks in the BlueBubbles UI to receive new-message
+//      pushes to <your-server>/webhooks/imessage instead of polling.
+//
+// Auth pattern:
+//   BlueBubbles uses ?password=<password> as a query-string credential on
+//   every request. We use timingSafeEqual on the inbound webhook signature
+//   (a SHA256 of the raw body, key=BLUEBUBBLES_PASSWORD) when validating
+//   pushes — BlueBubbles signs payloads via the `bb-signature` header on
+//   builds that have webhook signing enabled.
+//
+// Env required: BLUEBUBBLES_SERVER_URL, BLUEBUBBLES_PASSWORD.
+
+import { createHmac, randomUUID, timingSafeEqual } from 'node:crypto'
+
+const SIGNATURE_HEADER = 'bb-signature'
+
+interface BlueBubblesMessage {
+  guid?: string
+  text?: string
+  handle?: { address?: string }
+  chats?: Array<{ guid?: string }>
+  isFromMe?: boolean
+}
+
+interface BlueBubblesWebhookEnvelope {
+  // BlueBubbles wraps pushed events as { type, data }, e.g.
+  // { type: 'new-message', data: <Message> }.
+  type?: string
+  data?: BlueBubblesMessage
+}
+
+function readEnv(name: string): string {
+  const v = process.env[name]
+  if (!v) throw new Error(`imessage: missing required env var ${name}`)
+  return v
+}
+
+function trimTrailingSlash(s: string): string {
+  return s.endsWith('/') ? s.slice(0, -1) : s
+}
+
+function verifySignature(rawBody: string, headerValue: string | null): boolean {
+  // If BlueBubbles webhook signing isn't enabled, the header is absent — in
+  // that case, signature verification is impossible and the caller should
+  // either keep BlueBubbles on a private network or enable signing. We only
+  // accept signed payloads here; refusing unsigned traffic is the safer
+  // default given this is iMessage, not a public API.
+  if (!headerValue) return false
+  const password = readEnv('BLUEBUBBLES_PASSWORD')
+  const expected = createHmac('sha256', password).update(rawBody, 'utf8').digest('hex')
+  if (!/^[0-9a-f]+$/i.test(headerValue) || headerValue.length !== expected.length) return false
+  return timingSafeEqual(Buffer.from(headerValue, 'hex'), Buffer.from(expected, 'hex'))
+}
+
+/** Parse an inbound BlueBubbles webhook push (`new-message` event). Returns
+ * null when the body is unsigned, mismatched, not a `new-message`, sent by
+ * us, or missing chat/handle metadata. */
+export async function receive(
+  req: Request,
+): Promise<{ chatId: string; text: string; sender: string } | null> {
+  const rawBody = await req.text()
+  if (!verifySignature(rawBody, req.headers.get(SIGNATURE_HEADER))) return null
+
+  let payload: BlueBubblesWebhookEnvelope
+  try {
+    payload = JSON.parse(rawBody) as BlueBubblesWebhookEnvelope
+  } catch {
+    return null
+  }
+
+  if (payload.type !== 'new-message') return null
+  const msg = payload.data
+  if (!msg || msg.isFromMe) return null
+  const text = msg.text
+  const chatGuid = msg.chats?.[0]?.guid
+  const sender = msg.handle?.address
+  if (!text || !chatGuid || !sender) return null
+  return { chatId: chatGuid, text, sender }
+}
+
+/** Send a text iMessage via BlueBubbles. `chatId` is the BlueBubbles chat
+ * GUID (e.g. `iMessage;-;+15555550123` for a 1:1, or a group GUID). */
+export async function send(chatId: string, text: string): Promise<void> {
+  const base = trimTrailingSlash(readEnv('BLUEBUBBLES_SERVER_URL'))
+  const password = readEnv('BLUEBUBBLES_PASSWORD')
+  const url = `${base}/api/v1/message/text?password=${encodeURIComponent(password)}`
+
+  const res = await fetch(url, {
+    method: 'POST',
+    headers: { 'content-type': 'application/json' },
+    body: JSON.stringify({
+      chatGuid: chatId,
+      tempGuid: randomUUID(),
+      message: text,
+      method: 'apple-script',
+    }),
+  })
+
+  if (!res.ok) {
+    const detail = await res.text().catch(() => '')
+    throw new Error(`imessage send failed: ${res.status} ${res.statusText} — ${detail.slice(0, 500)}`)
+  }
+}
+
+export const channelMeta = {
+  id: 'imessage' as const,
+  envVars: ['BLUEBUBBLES_SERVER_URL', 'BLUEBUBBLES_PASSWORD'] as const,
+  inbound: 'webhook' as const,
+  outbound: 'POST' as const,
+}

package/registry/layers/agent-channels/imessage/manifest.json

@@ -0,0 +1,102 @@
+{
+  "id": "imessage",
+  "slot": "agent-channels",
+  "description": "iMessage channel adapter via the BlueBubbles HTTP relay (https://bluebubbles.app). Apple does not expose a server-side iMessage API; BlueBubbles is the standard community workaround that runs on a macOS host you control. receive() polls /api/v1/message/<chatGuid>; send() POSTs to /api/v1/message/text. Honest gap: pure-cloud iMessage is impossible \u2014 this layer requires a Mac with BlueBubbles configured.",
+  "appliesTo": [
+    "agent-runtime-account-executive-ts",
+    "agent-runtime-architect-ts",
+    "agent-runtime-auditor-ts",
+    "agent-runtime-biology-research-ts",
+    "agent-runtime-business-partner-ts",
+    "agent-runtime-career-coach-ts",
+    "agent-runtime-chef-ts",
+    "agent-runtime-chemistry-research-ts",
+    "agent-runtime-cmo-advisor-ts",
+    "agent-runtime-college-counselor-ts",
+    "agent-runtime-cs-research-ts",
+    "agent-runtime-cs-tutor-ts",
+    "agent-runtime-customer-success-ts",
+    "agent-runtime-data-analyst-ts",
+    "agent-runtime-designer-ts",
+    "agent-runtime-devops-ts",
+    "agent-runtime-doctor-ts",
+    "agent-runtime-engineering-manager-ts",
+    "agent-runtime-essay-coach-ts",
+    "agent-runtime-financial-analyst-ts",
+    "agent-runtime-fitness-coach-ts",
+    "agent-runtime-friend-ts",
+    "agent-runtime-game-designer-ts",
+    "agent-runtime-grant-writer-ts",
+    "agent-runtime-history-tutor-ts",
+    "agent-runtime-illustrator-ts",
+    "agent-runtime-language-tutor-ts",
+    "agent-runtime-legal-counsel-ts",
+    "agent-runtime-math-research-ts",
+    "agent-runtime-math-tutor-ts",
+    "agent-runtime-mediator-ts",
+    "agent-runtime-meditation-coach-ts",
+    "agent-runtime-ml-research-ts",
+    "agent-runtime-music-producer-ts",
+    "agent-runtime-novelist-coach-ts",
+    "agent-runtime-nutritionist-ts",
+    "agent-runtime-pentester-ts",
+    "agent-runtime-pharmacist-ts",
+    "agent-runtime-photographer-ts",
+    "agent-runtime-physics-research-ts",
+    "agent-runtime-product-manager-ts",
+    "agent-runtime-real-estate-ts",
+    "agent-runtime-recruiter-ts",
+    "agent-runtime-relationship-coach-ts",
+    "agent-runtime-research",
+    "agent-runtime-sales-engineer-ts",
+    "agent-runtime-screenwriter-ts",
+    "agent-runtime-security-engineer-ts",
+    "agent-runtime-tax-ts",
+    "agent-runtime-therapist-ts",
+    "agent-runtime-travel-planner-ts",
+    "agent-runtime-veterinarian-ts",
+    "agent-runtime-wealth-manager-ts",
+    "multi-agent-creative-studio-ts",
+    "multi-agent-legal-ops-ts",
+    "multi-agent-product-ops-ts",
+    "multi-agent-research-lab-ts",
+    "multi-agent-startup-team-ts"
+  ],
+  "provides": [
+    "channel:imessage"
+  ],
+  "defaults": {
+    "channelId": "imessage",
+    "transport": "bluebubbles-http",
+    "envVars": [
+      "BLUEBUBBLES_SERVER_URL",
+      "BLUEBUBBLES_PASSWORD"
+    ]
+  },
+  "files": [
+    {
+      "source": "files/channels/imessage.ts",
+      "target": "channels/imessage.ts"
+    },
+    {
+      "source": "files/channels/imessage.env.example",
+      "target": "channels/imessage.env.example"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "src/channels/imessage.ts"
+    },
+    {
+      "type": "file-exists",
+      "path": "src/channels/imessage.env.example"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "src/channels/imessage.ts"
+    ],
+    "commands": []
+  }
+}

package/registry/layers/agent-channels/linear/files/channels/linear.env.example

@@ -0,0 +1,42 @@
+# Linear channel adapter — webhook receive + GraphQL send
+#
+# ── LINEAR_API_KEY ─────────────────────────────────────────────────────────
+# A personal API key. The agent posts comments AS the user who owns this
+# key, so create one for a service account if you don't want comments to
+# look like they came from a human teammate.
+#
+# Mint at: https://linear.app/settings/api → "Personal API keys" → "Create
+# key". Scope is implicit (full account access); there is no granular
+# selection in Linear's UI today.
+#
+# Treat as a secret. Anyone with this key can read/write the team's data.
+LINEAR_API_KEY=
+
+# ── LINEAR_WEBHOOK_SECRET ──────────────────────────────────────────────────
+# Used to HMAC-SHA256 sign every webhook POST. Linear puts the hex digest in
+# the `Linear-Signature` header; receive() verifies it constant-time and
+# throws on mismatch so the agent's HTTP layer returns 401 (no silent drop).
+#
+# Configure at: https://linear.app/settings/api/webhooks → "New webhook"
+#   • URL: https://<your-deploy>/channels/linear
+#   • Resources: tick "Comments" and "Issues"
+#   • Signing secret: Linear generates one per webhook — paste it below.
+#
+# Docs: https://linear.app/developers/webhooks#securing-webhooks
+LINEAR_WEBHOOK_SECRET=
+
+# ── Operational notes ──────────────────────────────────────────────────────
+# • The adapter only forwards Issue/create and Comment/create today (Linear
+#   also delivers update + remove for both — we drop them as null). If you
+#   want the agent to react to issue edits or status changes, extend the
+#   switch in receive() and pass the action through.
+#
+# • send() always creates a Comment on the issue id you got from receive().
+#   To create a brand-new issue from the agent, use issueCreate(input:
+#   IssueCreateInput!) — different mutation, not wired here.
+#
+# • GraphQL endpoint: https://api.linear.app/graphql
+#   GraphQL schema docs: https://linear.app/developers/graphql
+#
+# • Webhook payload reference (fields receive() reads):
+#   https://linear.app/developers/webhooks#payload-format

package/registry/layers/agent-channels/linear/files/channels/linear.ts

@@ -0,0 +1,163 @@
+// MIT — original implementation. Webhook signature verification follows
+// Linear's official pattern (HMAC-SHA256 of the raw request body, compared
+// constant-time against the `Linear-Signature` header). Outbound replies use
+// the Linear GraphQL API (commentCreate) at api.linear.app/graphql with a
+// personal API key in the Authorization header. See linear.env.example.
+
+const GRAPHQL_URL = 'https://api.linear.app/graphql'
+
+export interface LinearInbound {
+  /** Linear issue id (UUID). Use as the chat key when calling send(). */
+  chatId: string
+  text: string
+  sender: string
+  /** Event type from the webhook payload, useful for filtering. */
+  event: 'Issue' | 'Comment'
+  /** Action: create | update | remove (Linear delivers all three for both types). */
+  action: 'create' | 'update' | 'remove'
+}
+
+interface LinearWebhookPayload {
+  type: 'Issue' | 'Comment'
+  action: 'create' | 'update' | 'remove'
+  data: LinearWebhookData
+  createdAt?: string
+}
+
+interface LinearWebhookData {
+  id?: string
+  // Comment fields
+  body?: string
+  issueId?: string
+  // Issue fields
+  title?: string
+  description?: string
+  // Both
+  user?: { id?: string; email?: string; name?: string }
+  // Comment.user is the author; Issue actor lives in top-level payload on some events.
+}
+
+function apiKey(): string {
+  const k = process.env.LINEAR_API_KEY
+  if (!k) throw new Error('linear channel: LINEAR_API_KEY not set')
+  return k
+}
+
+function webhookSecret(): string {
+  const s = process.env.LINEAR_WEBHOOK_SECRET
+  if (!s) throw new Error('linear channel: LINEAR_WEBHOOK_SECRET not set')
+  return s
+}
+
+/** Constant-time hex-string compare. Throws if lengths differ — but only after
+ *  doing the full XOR walk on the shorter side, so no length-leak shortcut. */
+function timingSafeEqualHex(a: string, b: string): boolean {
+  if (a.length !== b.length) {
+    // Walk anyway to discourage length-based side channels in the caller.
+    let acc = 1
+    const n = Math.min(a.length, b.length)
+    for (let i = 0; i < n; i++) acc |= a.charCodeAt(i) ^ b.charCodeAt(i)
+    return false
+  }
+  let acc = 0
+  for (let i = 0; i < a.length; i++) acc |= a.charCodeAt(i) ^ b.charCodeAt(i)
+  return acc === 0
+}
+
+async function hmacSha256Hex(secret: string, body: string): Promise<string> {
+  const enc = new TextEncoder()
+  const key = await crypto.subtle.importKey(
+    'raw',
+    enc.encode(secret),
+    { name: 'HMAC', hash: 'SHA-256' },
+    false,
+    ['sign'],
+  )
+  const sig = await crypto.subtle.sign('HMAC', key, enc.encode(body))
+  return [...new Uint8Array(sig)].map((b) => b.toString(16).padStart(2, '0')).join('')
+}
+
+/** Parse a Linear webhook POST. Verifies HMAC-SHA256 against the
+ *  `Linear-Signature` header. Returns null for events we don't handle
+ *  (everything except Issue/create + Comment/create). Throws on bad signature
+ *  so the agent's HTTP layer returns 401 — no silent drop. */
+export async function receive(req: Request): Promise<LinearInbound | null> {
+  const sigHeader = req.headers.get('linear-signature')
+  if (!sigHeader) throw new Error('linear webhook: missing Linear-Signature header')
+  const raw = await req.text()
+  const expected = await hmacSha256Hex(webhookSecret(), raw)
+  if (!timingSafeEqualHex(expected, sigHeader.toLowerCase())) {
+    throw new Error('linear webhook: signature mismatch')
+  }
+
+  const payload = JSON.parse(raw) as LinearWebhookPayload
+  if (payload.action !== 'create') return null
+  if (payload.type !== 'Issue' && payload.type !== 'Comment') return null
+
+  if (payload.type === 'Comment') {
+    const issueId = payload.data.issueId
+    const body = payload.data.body
+    if (!issueId || !body) return null
+    return {
+      chatId: issueId,
+      text: body,
+      sender: payload.data.user?.email ?? payload.data.user?.name ?? 'unknown',
+      event: 'Comment',
+      action: 'create',
+    }
+  }
+
+  // Issue/create
+  const issueId = payload.data.id
+  const title = payload.data.title
+  if (!issueId || !title) return null
+  const text = payload.data.description ? `${title}\n\n${payload.data.description}` : title
+  return {
+    chatId: issueId,
+    text,
+    sender: payload.data.user?.email ?? payload.data.user?.name ?? 'unknown',
+    event: 'Issue',
+    action: 'create',
+  }
+}
+
+/** Post a comment on a Linear issue. `target` is the issue id from receive(). */
+export async function send(target: string, text: string): Promise<void> {
+  const mutation = `
+    mutation CommentCreate($issueId: String!, $body: String!) {
+      commentCreate(input: { issueId: $issueId, body: $body }) {
+        success
+        comment { id }
+      }
+    }
+  `
+  const res = await fetch(GRAPHQL_URL, {
+    method: 'POST',
+    headers: {
+      authorization: apiKey(),
+      'content-type': 'application/json',
+    },
+    body: JSON.stringify({ query: mutation, variables: { issueId: target, body: text } }),
+  })
+  if (!res.ok) {
+    const detail = await res.text().catch(() => '')
+    throw new Error(`linear commentCreate ${res.status}: ${detail.slice(0, 200)}`)
+  }
+  const json = (await res.json()) as {
+    data?: { commentCreate?: { success?: boolean } }
+    errors?: Array<{ message: string }>
+  }
+  if (json.errors?.length) {
+    throw new Error(`linear commentCreate graphql: ${json.errors.map((e) => e.message).join('; ')}`)
+  }
+  if (!json.data?.commentCreate?.success) {
+    throw new Error('linear commentCreate: success=false')
+  }
+}
+
+export const channelMeta = {
+  id: 'linear' as const,
+  envVars: ['LINEAR_API_KEY', 'LINEAR_WEBHOOK_SECRET'] as const,
+  inbound: 'webhook' as const,
+  outbound: 'POST' as const,
+}

package/registry/layers/agent-channels/linear/manifest.json

@@ -0,0 +1,95 @@
+{
+  "id": "linear",
+  "slot": "agent-channels",
+  "description": "Linear channel adapter \u2014 webhook receive (Issue + Comment events, HMAC-SHA256 signature verified against Linear-Signature header) + GraphQL commentCreate send via api.linear.app/graphql with bearer auth. Composes with any agent-runtime bundle. Set LINEAR_API_KEY and LINEAR_WEBHOOK_SECRET at deploy.",
+  "appliesTo": [
+    "agent-runtime-account-executive-ts",
+    "agent-runtime-architect-ts",
+    "agent-runtime-auditor-ts",
+    "agent-runtime-biology-research-ts",
+    "agent-runtime-business-partner-ts",
+    "agent-runtime-career-coach-ts",
+    "agent-runtime-chef-ts",
+    "agent-runtime-chemistry-research-ts",
+    "agent-runtime-cmo-advisor-ts",
+    "agent-runtime-college-counselor-ts",
+    "agent-runtime-cs-research-ts",
+    "agent-runtime-cs-tutor-ts",
+    "agent-runtime-customer-success-ts",
+    "agent-runtime-data-analyst-ts",
+    "agent-runtime-designer-ts",
+    "agent-runtime-devops-ts",
+    "agent-runtime-doctor-ts",
+    "agent-runtime-engineering-manager-ts",
+    "agent-runtime-essay-coach-ts",
+    "agent-runtime-financial-analyst-ts",
+    "agent-runtime-fitness-coach-ts",
+    "agent-runtime-friend-ts",
+    "agent-runtime-game-designer-ts",
+    "agent-runtime-grant-writer-ts",
+    "agent-runtime-history-tutor-ts",
+    "agent-runtime-illustrator-ts",
+    "agent-runtime-language-tutor-ts",
+    "agent-runtime-legal-counsel-ts",
+    "agent-runtime-math-research-ts",
+    "agent-runtime-math-tutor-ts",
+    "agent-runtime-mediator-ts",
+    "agent-runtime-meditation-coach-ts",
+    "agent-runtime-ml-research-ts",
+    "agent-runtime-music-producer-ts",
+    "agent-runtime-novelist-coach-ts",
+    "agent-runtime-nutritionist-ts",
+    "agent-runtime-pentester-ts",
+    "agent-runtime-pharmacist-ts",
+    "agent-runtime-photographer-ts",
+    "agent-runtime-physics-research-ts",
+    "agent-runtime-product-manager-ts",
+    "agent-runtime-real-estate-ts",
+    "agent-runtime-recruiter-ts",
+    "agent-runtime-relationship-coach-ts",
+    "agent-runtime-research",
+    "agent-runtime-sales-engineer-ts",
+    "agent-runtime-screenwriter-ts",
+    "agent-runtime-security-engineer-ts",
+    "agent-runtime-tax-ts",
+    "agent-runtime-therapist-ts",
+    "agent-runtime-travel-planner-ts",
+    "agent-runtime-veterinarian-ts",
+    "agent-runtime-wealth-manager-ts",
+    "multi-agent-creative-studio-ts",
+    "multi-agent-legal-ops-ts",
+    "multi-agent-product-ops-ts",
+    "multi-agent-research-lab-ts",
+    "multi-agent-startup-team-ts"
+  ],
+  "provides": [
+    "channel:linear"
+  ],
+  "requires": [
+    "secure:webhook-in"
+  ],
+  "defaults": {
+    "channelLinearAvailable": true
+  },
+  "files": [
+    {
+      "source": "files/channels/linear.ts",
+      "target": "channels/linear.ts"
+    },
+    {
+      "source": "files/channels/linear.env.example",
+      "target": "channels/linear.env.example"
+    }
+  ],
+  "validationChecks": [
+    {
+      "type": "file-exists",
+      "path": "channels/linear.ts"
+    }
+  ],
+  "contextHints": {
+    "extensionPoints": [
+      "channels/linear.ts"
+    ]
+  }
+}

package/registry/layers/agent-channels/slack/files/channels/slack.env.example

@@ -0,0 +1,17 @@
+# Slack channel adapter
+# SLACK_BOT_TOKEN: https://api.slack.com/apps → your app → OAuth & Permissions.
+#   After installing to your workspace, copy the "Bot User OAuth Token"
+#   (starts with xoxb-). Used as Authorization: Bearer <token>.
+SLACK_BOT_TOKEN=
+
+# SLACK_SIGNING_SECRET: same app → Basic Information → App Credentials →
+#   Signing Secret. Used to verify HMAC-SHA256 (v0 scheme) on every inbound
+#   Events API POST. Required — Slack will mark your endpoint failing if
+#   verification doesn't succeed.
+SLACK_SIGNING_SECRET=
+
+# After deploy, set Event Subscriptions → Request URL in the Slack dashboard:
+#   <your-https-url>/channels/slack
+# Slack POSTs once with type=url_verification + a `challenge` field; the
+# server should respond with HTTP 200 and the challenge value as plain text.
+# Subscribe to bot events: message.channels, message.im, app_mention.